CVE-2019-9879

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

• CWE-306

• http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
• https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
• https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory

Published

Jun 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9872In several versions of JetBrains IntelliJ IDEA Ultimate, cre…
• CVE-2019-9873In several versions of JetBrains IntelliJ IDEA Ultimate, cre…
• CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.A…9.8
• CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in…8.8
• CVE-2019-9877There is an invalid memory access vulnerability in the funct…
• CVE-2019-9878There is an invalid memory access in the function GfxIndexed…
• CVE-2019-9880An issue was discovered in the WPGraphQL 0.2.3 plugin for Wo…
• CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for…
• CVE-2019-9882Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9884eClass platform < ip.2.5.10.2.1 allows an attacker to use GE…9.8
• CVE-2019-9885eClass platform < ip.2.5.10.2.1 allows an attacker to execut…9.8